# Escaping Cascading Style Sheets CSS is similar to [escaping Javascript](escaping-javascript.md). CSS escaping excludes only basic alphanumeric characters and escapes all other characters into valid CSS hexadecimal escapes. ## Example of Bad CSS Escaping In most cases developers forget to escape CSS completely: ```php '); } INPUT; ?> Unescaped CSS

User controlled CSS needs to be properly escaped!

``` In the above example, by failing to escape the user provided CSS, an attacker can execute an XSS attack fairly easily. ## Example of Good CSS Escaping By using `escapeCss()` method in the CSS context, such attacks can be prevented: ```php '); } INPUT; $escaper = new Zend\Escaper\Escaper('utf-8'); $output = $escaper->escapeCss($input); ?> Escaped CSS

User controlled CSS needs to be properly escaped!

``` By properly escaping user controlled CSS, we can prevent XSS attacks in our web applications.